← Vulnerability feed

Vulnerability record · CVE-2018-11132 · published 31 May 2018

CVE-2018-11132: Quest kace system management appliance os command injection vulnerability

Quest · Kace System Management Appliance

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.

8.8 CVSS 3.0 High EPSS 18% · top 2.9% CWE-78 · OS command injection
8.8CVSS 3.0 base score, v2 9.0
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory

Track CVE-2018-11132 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-11138Quest KACE System Management Appliance unauthenticated OS command injectionThe download_agent_installer.php script in Quest KACE System Management Appliance 8.0.318 is reachable by anonymous users and passes input to the ope…KEVEPSS 92%analysed9.8CVE-2018-11136Quest kace system management appliance sql injection vulnerabilityThe 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sani…EPSS 1.4%9.8CVE-2018-11140Quest kace system management appliance sql injection vulnerabilityThe 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, lead…EPSS 1.4%9.8CVE-2018-11141Quest kace system management appliance path traversal vulnerabilityThe 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Applianc…EPSS 2.0%8.8CVE-2018-11134Quest kace system management appliance weak password recovery vulnerabilityIn order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed tha…EPSS 3.0%8.8CVE-2018-11135Quest kace system management appliance prototype pollution vulnerabilityThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object inject…EPSS 2.1%8.8CVE-2018-11139Quest kace system management appliance os command injection vulnerabilityThe '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and…EPSS 43%6.5CVE-2018-11137Quest kace system management appliance path traversal vulnerabilityThe 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read …EPSS 6.5%

Source: NIST National Vulnerability Database (record CVE-2018-11132), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.